ISP’s e-mail password reset system is a guy named “Shawn”

Lost your e-mail password? An ISP in the US will give it to you in a Web chat.

Andrew Silverman, a customer of Frontier Communications in Washington state, rarely uses the e-mail address that comes with his Internet service.

But when he needed to log in to the Frontier e-mail a week ago, he discovered that the Internet service provider has a surprisingly poor approach to password security. Silverman had forgotten the password to this little-used account but found that the Frontier e-mail website provides no self-service method for resetting the password. The only option was to chat with a Frontier employee. And that employee, Shawn from tech support, had access to Andrew's password in plain text and was ready and willing to share it.

Shawn asked Silverman for some basic pieces of information—his account number or landline number, the e-mail address he was having trouble with, and the last four digits of his Social Security number. The Frontier employee then asked Silverman what password he tried to type in.

"I'm not comfortable giving out passwords. Is there a password reset page?" Silverman asked.

"I'm sorry there isn't," Shawn replied. "Are you OK with me posting the password in chat? It is a secure network and I have the password in front of me."

Silverman pointed out how ridiculous this system is but accepted Shawn's offer and received the password. Before ending the chat, Shawn tried to sell Silverman antivirus software, computer tech support, or "identity protection." Silverman declined. The Frontier system then e-mailed Silverman a full transcript of the chat, including the password in plain text. The only information Frontier obscured was his account number.

Organizations with good password security use cryptographic hash functions to obscure passwords. This lessens (but does not completely eliminate) the risk of hackers obtaining plain text passwords when they break into a password database. Storing passwords in plain text from the beginning makes it far too easy for thieves to steal people's identities.

Further Reading

Silverman, who uses Frontier for broadband and phone service, contacted Ars from his primary e-mail address. He also provided us the chat transcript (while obscuring the password).

We verified the incident with Frontier's public relations staff. The company acknowledged to Ars that it offers no way for customers to reset forgotten e-mail passwords on their own and that its employees have access to passwords in plain text.

"Customers can change their passwords through the Account Manager page, assuming they know their current password. If they have forgotten it, they must contact Frontier via chat or by phone," a Frontier spokesperson told Ars.

In Washington, Frontier is operating former Verizon networks that it bought in 2010. Frontier is also buying Verizon fiber and copper networks in California, Florida, and Texas in a deal that may be completed soon.

Tech support reps have your password

While Silverman doesn't rely on Frontier for his primary e-mail communications, he said the company's disturbing security practices make him worry about how it stores his private information.

Though the chat system uses HTTPS, Silverman pointed out that the representative providing his password in the chat "is still entirely unacceptable because it implies that the passwords to the system are either not being stored in encrypted form at all, opening them up to a major customer info disclosure, or that at minimum, they are stored in a reversible fashion such that any customer representative can see the user's actual passwords, which opens up the potential for employee abuse of customer accounts.

"The system then sent me a transcript in clear unprotected e-mail, which (of course) included the posted password in raw text," Silverman continued. "However, they were nice enough to #-mark out the account number (if not the password). I'd rather it was the other way around, frankly."

Frontier insisted that its password practices are secure but was stingy with details. This is how part of our exchange with Frontier went:

Ars: Does Frontier store all webmail passwords in plain text? How does the company protect them? Why would customer service reps be given access to customer passwords in plain text?

Frontier: Customer Service Reps do not have access, only Tech Support does and it is only revealed once the customer has provided the security code to verify identity. Account modification logs are kept to ensure the Company knows who accessed the information.

Frontier also said that it only provided Silverman a password after "we verified identity first through security questions." But as Silverman told Ars, "the only security challenges they posed were to provide the account number OR the landline service number in combination with the last 4 of the social security number."

Frontier's answer that customers can change passwords online if they know their current password "is rather pointless, since this whole conversation stems from not providing a secure and self-serve means of resetting a forgotten password without human intervention," Silverman wrote. "I can't think of a single other site I use, financial or otherwise, that doesn't have that functionality with either security challenges or email verification of the request, all automated."

After regaining access to the e-mail account, he did change his password.

Frontier refuses to say how it stores passwords

Besides the Frontier e-mail and password, Frontier customers have a different login to manage billing and services for their Internet, TV, and phone accounts. This entirely separate system does offer a self-service portal for resetting forgotten passwords.

We asked Frontier if it stores passwords for this account system in an obscured form (i.e. salted and hashed). We also asked why it has different levels of security for its e-mail accounts and billing accounts. Frontier declined to provide any details, saying that "All customer information is secured and stored appropriately. As a matter of policy Frontier does not disclose details of how it protects sensitive information as the dissemination of such details can itself be a security risk."

Frontier isn't the only Internet service provider with a questionable e-mail system. Comcast customer Andy Weir, author of The Martian, said this month that a hacker was able to reset the password for his Comcast.net e-mail account by calling Comcast and pretending to be him. To regain access to his account, Weir said he only had to provide his street address and the last four digits of his Social Security number.